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1 INTRODUCTION 


1.1 General project description 


QSAR is a large, normally pressured gas-condensate reservoir located in the Western 
Desert of Egypt approximately 525 km west of Cairo. The field is operated by Khalda 
Petroleum Company (KPC), a joint venture between Apache Corporation and Egyptian 
General Petroleum Company (EGPC). 


Field production is initially handled at the Start of Line (SOL) Qasr Plant. After initial 
treatment (cooling and water removal) the gas/condensate is exported to a combination of 
the Salam, Tarek and Obaiyed gas plants for further treatment. The Qasr gas and 
condensate currently free flows from the wellheads through the Qasr Phase I and Phase II 
facilities and export pipelines to the SHAMS manifold and Salam gas plant under reservoir 
pressure. As the reservoir pressure declines the peak gas rate of 800 mmscfd will no 
longer be achievable. The QSAR Compression Project is designed to improve recovery as 
the reservoir production rate and pressure decline. The Qasr Compression Project scope 
comprises: 


* Gas turbine driven single stage compressor sets 
e Condensate export pumps 


* Utility systems 


1.2 Scope 


This procedure defines modalities and methodologies to be followed in developing the SIL 
Allocation Study for the QASR Compression Project. 
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1.3 List of definitions and abbreviations 


1.3.1 Definitions 
Company 

Project 
Contractor 
Consultant 


Basic Process 
Control System 


Beta Factor 
Common Mode 
Failure 


Dangerous Failure 


Dangerous Failure 
Rate 


Demand Rate 


Diagnostic Coverage 


Factor 


Design Intent 


Failure 


KPC 

QSAR Compression 

ENPPI 

The party which will perform the study (ICARO) 


The system that responds to input signals from the process and 
generates output signals to maintain operation of the process in a 
desired state. The system does not perform functions assessed as 
SIL 1 or higher. 


The number of Common Mode Failures (of robust Initiators or Final 
Elements), expressed as a fraction of all possible Failures. 


A Failure having the potential to affect all duplicated components in a 
robust configuration by virtue of common or shared characteristics. 


A Failure that has the potential to place the SIF in a state in which it 
will fail to perform its function. Dangerous Failures are usually only 
safe when the system has to perform a certain action or through 
testing. Also known as unrevealed failure. 


The number of Dangerous Failures per unit time. 


The frequency at which a Demand occurs, i.e., the number of 
Demands per unit time. 


The number of Dangerous Failures that diagnostic features are 
capable of detecting, expressed as a fraction of all possible 
dangerous failures. 


(NOTE: Diagnostic features may only be recognised as such if they 
can trip the process to a safe state or maintain safety by different 
means.) 


Protective action of the Safety Instrumented Function 


An abnormal condition that may cause a reduction or loss of 
capability of the SIF to perform its intended function. 
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Final Element 


Hazard or Hazardous 
Situation 


Initiator 


Independent 
Protection Layer 


Intermediate Event 
Likelihood 


Logic Solver 


Mitigation 
Probability of Failure 
on Demand 


Programmable 
electronics 


Proof Test 


Risk 


Safe Failure 


A device, or combination of devices, that manipulate a process 
variable or attract the attention of the operator to achieve risk 
reduction. The Final Element includes output cards or output relays, 
solenoid valves and cabling. Examples are valves, switchgear 
(rotating equipment stop circuits) and alarms. 


A situation with the potential to cause harm, including ill health and 
injury, damage to property, products or the environment, production 
losses or increased liabilities. 


A device, or combination of devices, that indicates whether a process 
or equipment item is operating outside the operating envelope. In IEC 
61508/61511 an Initiator is referred to as a Sensor. 


Device, system, or action that is capable of preventing a postulated 
accident sequence from proceeding to a defined, undesirable 
endpoint. An IPL is (1) independent of the event that initiated the 
accident sequence and (2) independent of any other IPLs. IPLs are 
normally identified during layer of protection analyses. 


Frequency of the undesired event before the mitigating factor 
provided the the SIF 


The portion of a SIF that performs the application logic function. The 
Logic Solver excludes trip amplifiers, input cards and output cards. 
Examples are electromechanical relays, solid-state/magnetic-core 
logic and the CPU section of programmable electronic systems. 


The action of making a consequence less severe or relieving 
consequences. 


The probability (dimensionless) of the SIF failing to respond to a 
Demand. 


Electronic component or device forming part of a PES and based on 
computer technology. The term encompasses both hardware and 
software and input and output units. 


(Examples of process sector programmable electronics include: smart 
sensors; final elements; and programmable electronic logic solvers, 
such as, programmable controllers, PLCs, DCS, loop controllers.) 


A test carried out on SIF components against an approved procedure 
to confirm that all requirements of the SIF are met. 


The frequency at which a Hazardous Situation occurs multiplied by 
the consequence of the Hazardous Situation. 


A Failure whose occurrence does not have the potential to place a 
SIF in a dangerous state. Also known as revealed failure. 
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Safety Instrumented 
Function 


Safety Integrity Level 


Target Mitigated 
Event Likelihood 


Time Risk 


Trip 


Validation 


Verification 


A function comprising one or more Initiators, a Logic Solver and one 
or more Final Elements whose purpose is to prevent or mitigate 
hazardous situations. 


A SIF is intended to achieve or maintain a safe state for the process, 
in respect of a specific hazardous event. 


Dangerous failure class 1, 2, 3 or 4 derived from the consequences of 
failure on demand and the frequency of demand. The definition in IEC 
61511: discrete level (one out of four) for specifying the safety 
integrity requirements of the SIF to be allocated to the SIS (trip 
systems). Safety integrity level 4 has the highest level of safety 
integrity; safety integrity level 1 has the lowest. 


Maximum acceptable frequency for specified severity of consequence 
of the undesired event 


The fraction of overall year time during which the SIF is asked to be 
active. Normally for continuous operating unit, Time risk is set to 1; for 
intermittent process, Time risk is set to a fraction value. 


An SIF action to bring the Final Element to a safe state. 


Confirmation that the system under consideration fully meets the 
integrity requirements set forth in the associated SIF Requirements 
Specification. 


Demonstration for a particular life-cycle phase that all deliverables 
(documents, software, hardware) meet the objectives set for that 
phase. 
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1.3.2 Abbreviations 


AIL Assets Integrity Level 

BDV Blow-Down Valve 

BPCS Basic Process Control System 
C&ED Cause and Effects Diagram 

DCS Distributed Control System 

ESD Emergency Shut Down 

F&G Fire and Gas 

HAZOP Hazard and operability study 

IE Initiating Event 

IEC International Electro technical Commission 
IEL Intermediate Event Likelihood 
IPL Independent Protection Layer 
LOPA Level Of Protection Analysis 
P&ID Piping and Instrumentation Diagram 
PES Programmable Electronic System 
PLC Programmable Logic Controller 
PFD Probability of Failure on Demand 
PSV Pressure Safety Valve 

ESDV Emergency Shut Down Valve 
SIF Safety Instrumented Function 
SIL Safety integrity Level 

TMEL Target Mitigated Event Likelihood 


1.4 References 


o IEC 61508-2008“ Functional safety of electrical/electronic/programmable electronic 
safety-related systems". 


o IEC 61511-2003“ Functional safety — Safety instrumented systems for the process 
industry sector. 


T 


Page 8 of 21 


KPC Western Desert - EGYPT 


E & QASR COMPRESSION STATION PROJECT C ARO 
jippi SIL ALLOCATION STUDY 


. DOCUMENT TITLE: PROCEDURE FOR SILAllocation STUDY Rev. No.: 0 
Project n? 3538-200 
DOCUMENT NUMBER: 131821-002 July 2013 


2 SIL ALLOCATION PURPOSE AND GENERAL DESCRIPTION 


2.4 SIL Allocation purpose and main topics 


A Safety Integrity Level (SIL) analysis is a key step in the Safety System Design 
Process. While the HAZOP process normally discovers potential hazards and provides 
general recommendations, the SIL is a specific analysis which defines the Safety Criteria 
and Mitigation of hazards which can lead to a significant safety, environmental and 
economic consequences. 


SIL analysis is performed according to the IEC 61508 ' extensive standard, which is 
essentially a framework for implementing instrumented safety systems using the 
principle of Safety Life Cycle, and the IEC 61511 ^ developed as a Process Sector 
implementation of IEC 61508. 


An important concept in the standard is that of the Safety Instrumented Function (SIF), 
which is a function to be implemented by an Safety Instrumented System (SIS) 
composed mainly by sensors (e.g. transmitters), logic solvers (E/E/PE) and final 
elements (e.g. solenoids), which is intended to achieve or maintain a safe state for the 
process, with respect to a specific hazardous event. 


A SIS can be seen as a method to reduce the overall risk, acting as independent 
protection layer, as showed in figure 1. 


1 Functional safety of electrical/electronic/programmable electronic safety-related systems 
2 Functional safety — Safety instrumented systems for the process industry sector 
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Figure 1. : Layer of protection in risk analysis 


COMMUNITY EMERGENCY RESPONSE 
Emergency broadcasting 


PLANT EMERGENCY RESPONSE 
Evacuation procedures 


MITIGATION 
Mechanical mitigation systems 
Safety instrumented control systems 
Safety instrumented mitigation systems 
Operator supervision 


PREVENTION 
Mechanical protection system 
Process alarms with operator corrective action 
Safety instrumented control systems 
Safety instrumented prevention systems 


CONTROL and MONITORING 
Basic process control systems 
Monitoring systems (process alarms) 
Operator supervision 


PROCESS 


From this point of view, an independent protection layer is a "system" fully independent 
from the others capable to reduce the risk, by preventive or protective actions, e.g. an 
explosion proof design, a PSV, an independent SIF, a F&G system, an emergency 
procedure, etc. 


Each key SIF must be evaluated for the severity of the protected risk and the 
performance of the SIF must be commensurate with the risk. The performance level for 
each SIF must address both the reliability and availability requirements of the SIF. Both 
of these factors are combined into a single index termed SIL, which is defined as the 
likelihood of the system satisfactorily performing the required safety function under all 
the stated conditions within a stated period of time. The SIL ratings can be equated to 
the Probability to Fail on Demand (PFD), in a defined interval of time, of the relevant SIF. 
Relationship between SIL and Process Failure on Demand is indicated in Table 1 in 
case of Shut Down Systems (not continuously operating systems ?). 


3 Low Demand Mode: where frequency of demands for operation made on a safety-related system is no greater 
than one per year and no greater than twice the proof-test frequency (IEC 61508-4) 
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Safety Integrity Level (SIL) Probability of failure on demand (PFD) 
4 10^ -d9^ 
3 10^ - 10? 
2 10? - 10? 
1 10°- 10" 


Table 1. — Relationship between SIL and Process Failure on Demand 


Same criteria apply also for the identification of the Asset Integrity Level of the 
plant/station. The analysis is to be done separately due to fact that productive asset is 
mainly linked to economic aspects (loss of production, loss of materials, etc.) and not 
necessarily linked with safety. Combined but distinct analysis allows to have a more 
complete picture of the risk and mostly to select the most appropriate level of protection. 
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3.1 Layer of Protection Analysis 


LOPA is a method for evaluating the effectiveness of protection layers in reducing the 
frequency and/or consequence severity of hazardous events. LOPA provides specific 
criteria and restrictions for evaluation of IPLs, reducing subjectivity of qualitative 
methods. 


As shown in previous Figure 1, a scenario may have one or more protection layers of 
various types, depending on complexity of process and potential severity of 
consequence. 


3.2 Independent Protection Layer identification 
IPLs shall be identified and selected according to the following criteria: 


1.Specificity: IPL is designed to prevent a postulated accident sequence from proceeding 
to a defined, undesirable endpoint (e.g., runaway reaction, release of toxic material, 
loss of contaminant, or fire). Multiple initiating causes may lead to same hazardous 
event, and therefore, multiple event scenarios may initiate action of one IPL. If an 
event can be initiated by different initiating causes, different IPLs can apply to the 
different initiating causes. 


2. Independence: IPL is independent of all other protection layers associated with 
identified potentially hazardous event. Independence requires that performance not 
be affected by failure of another protection layer or by conditions that caused 
another protection layer to fail. Protection layer are also independent of initiating 
cause. 


3. Dependability: Protection provided by IPL reduces identified risk by known and 
specified amount. 


4. Auditability: IPL is designed to enable periodic validation of protective function. 
Periodic testing and maintenance of IPL is required. 


3.3 SIL Assessment approach 


SIL assessment is based on application of LOPA on the results of the HAZOP study. 
The basic procedure is detailed herebelow. 


1. Each SIF is analyzed with reference to the consequences undesired event of HAZOP 
deviation for which the SIF itself has been claimed as Safeguard measure. 


2. Estimate the consequences of undesired event according to the qualitative 
classification provided in the present procedure. 


3. For each defined level of consequences (damage to people, asset and environment), 
a correlated TMEL is defined. 
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4. Define, on basis of selected referenced database, the associated likelihood to the 
initiating cause of the deviation. 


Define, on basis of selected referenced database, the Time Risk. 


Identify in the process and with reference to HAZOP study the presence and 
effectiveness of mitigating BPCS and consequently assess its unavailability 
according to selected referenced database; 


7. Identify in the process and with reference to HAZOP study, the presence and 
effectiveness of alarm that might give to operator the possibility of safe and timely 
mitigating action and consequently assess its unavailability according to selected 
referenced database. 


8. Estimate the probabilistic value of vulnerability of exposed persons to the effects of 
the identified scenario. 


9. Identify in the process and with reference to HAZOP study the presence and 
effectiveness of mitigating IPL and consequently assess its PFD according to 
selected referenced database. 


10. Calculate the IEL as the product of initial likelihood of the initiating cause and the 
unavailability of each protection layer; 


11. Calculate the quotient between TMEL and IEL and identify the required PFD to 
associated to the analyzed SIF in order to reach the expected results. 


12. Proceed to the subsequent SIF and repeat passages from 2 to 11. 


3.4 Consequence estimate and relevant TMEL 


Following table indicates the proposed values for classification of consequences of initial 
causes and relevant values of TMEL to be reached in SIL assessment. 


Severity Health and safety 


Environmental effects Asset effects TMEL 
Level consequences 
A Catastrophic health/ | Extensive damage outside 
safety incident causing | the industrial site fence to a 
very widespread fatalities | non-sensitive environment s00 million 1,00E-07 


within or outside aand which remains in an 
facility. Potential for 3 or | "unsatisfactory" state for a 
more fatalities. period > 5 yr. 


B l Extensive damage outside 
Catastrophic health/ the industrial site fence to a 
safety incident causing or 
widespread fatalities non-sensitive environment 
within or outside a ML NA NI E 
remediated to a "satisfactory" 


facility. Potential for 1 to / agreed state in a period of 2 
3 fatalities. 
yr to 4 yr. 


€ 20 million to 


€ 100 million 1,00E-06 
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Severity 


Health and safety 


Environmental effects Asset effects TMEL 
Level consequences 
C Very major health/ safety 
incident Extensive damage outside 
- Potential for 1 fatality. | the industrial site fence to a 
- 10 or more injuries or | non-sensitive environment €10 million to 
health effects to plant | and which can be remediated Hn 1,00E-05 
< | €20 million 
workforce, either | to a level which restores its 
permanent or requiring | environmental amenity in a 
hospital treatment for | period of 1 yr. 
more than 24 hr. 
D High impact — health/ 
safety incident 
- Permanent partial | Significant damage outside Ev milion to 
disability(ies) the plant fence but within €10 million 1,00E-04 
- Several non-permanent | industrial site fence 
injuries or health 
impacts. 
E Medium impact health/ 
safety incident ; : 
- Single or multiple e sd ee €500 k to €1 1.00E-03 
recordable injury or Me pant Jones But WEM jijian LEE 
industrial site fence 
health effects from 
common source/event. 
F Low impact  health/ 
evel First Lag Possible emission of 
88 | gas/liquid wastes outside the | €100 k to g 
Single or multiple Over plant fence but inside the site | €500 k 100E:02 
exposures causing | fonce 
noticeable irritation but 
no actual health effects 
G | Negligible effects. Increase of plant wastes | < e100k 1,00E-01 


(flushing, blow down) 


Table 2. — Classification of severity level of consequences and relevant TMEL to be achieved 
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3.5 Likelihood for initiating causes 


Following table indicates the proposed values for the likelihood of initiating causes. 


Initiating Cause ne an Data Source 
Pump and other rotating equipment 5,00E-02 Oreda 2002 
failure 
BPCS instrument loop failure 1,00E-01 CCPS 
Pump seal failure 1,00E-01 Oreda 2002 
Spurious closure of on off valve 5,00E-02 Exida 2007 
Utility unavailability (CW, N, LS, MS) 1,00E-01 CCPS 
Power failure 1,00E+00 Eng. Estimate 
Procedural mistake 1,00E-01 CW 
Unloading/loading hose failure 1,00E-02 Eng. Estimate 
Safety valve opens spuriously 1,00E-02 CCPS 
Incorrect alignment (manual valve 1,00E-01 CW 
on normal operation) 
Tube rupture in heat exchanger 5,00E-02 Eng. Estimate 
Incorrect alignment (manual valve 1,00E-01 CW 
on start up / shut down) 
External fire 1,00E-02 Eng. Estimate 


Table 3. — Values of likelihood for initiating causes 


3.6 Time risk 


Time risk is set equal to 1 for continuous process and for discontinuous process which 
are working for more than 10% of overall time. 


For discontinuous process which are working for less than 10% of overall time (e.g. 
loading from tank truck), the time risk is set equal to 0.1. 


3.7  BPCS 


In the case that the system is equipped with an independent process control 
system capable to prevent the undesired consequences, it is possible to claim a 
reduction factor equal to 0.1. 
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3.8 Alarms 


In the case that the system is equipped with a DCS alarm activated by a process upset 
detected by an independent measure, it is possible to claim a reduction factor. 


The suggested values are the same: 


e in case the alarms gives the operator more than 10 minutes to take action before the 
undesired event occurs: 0.1 


e in case the alarms gives the operator less than 10 minutes to take action before the 
undesired event occurs: 0.5 


3.9 Vulnerability 


Vulnerability factor takes into account the probability for a person to be directly involved 
in the effects of undesired event. The factor shall take into consideration both the 
dynamics of the final scenario (e.g. fire) and the effective presence of people in the area 
inside which the impact from the scenario is expected. Suggested values are the 
following: 


Jet fire/explosion in frequently manned areas: 1 

Jet fire/explosion in not frequently manned areas: 0,5 
Pool fire / flash fire in frequently manned areas: 0,5 
Pool fire / flash fire in not frequently manned areas: 0,1 


3.10 Independent Protection layers 


Following table indicates the proposed values for the PFD of Level of Protection 
elements. 


IPL PFD Data Source 
PSV specifically designed for the 1,00E-02 Oreda 2002 
scenario 
Rupture disk specifically designed 1,00E-02 Oreda 2002 
for the scenario 
BPCS 1,00E-01 CCPS 
Dike, bund 1,00E-01 Eng. Estimate 
Sewer system 1,00E-01 Eng. Estimate 


Table 4. — PFD for different level of protection elements 


Page 16 of 21 


KPC Western Desert - EGYPT 


E & QASR COMPRESSION STATION PROJECT C ARO 
jippi SIL ALLOCATION STUDY 


. DOCUMENT TITLE: PROCEDURE FOR SILAllocation STUDY Rev. No.: 0 
Project n? 3538-200 
DOCUMENT NUMBER: 131821-002 July 2013 


3.11 Reference for the selected probability values 


o CW: Cremer & Warner - App IX in COVO Commission- “Risk analysis of six potentially 
hazardous industrial objects in the Rijnmond Area, a pilot study — A report to the 
Rijnmond Public Authority", 1981 


o CCPS: Process Equipment reliability data base, Center for Chemical Process 
Safety,1989 


o Oreda 2002: Offshore Reliability Data Handbook, OREDA — 4" Edition, 2002 


o Exida 2007: Safety Equipment Reliability Handbook, Exida — 3 Edition, 2007 


3.12 SIL Allocation report 
e Scope of the study; 
e Process descriptions; 
e Methodology description; 
e Table of deviations; 
e Attendance list; 
e Nodes list; 
e Reference documentation; 
e C&EDs used for the sessions (“master copies"); 
e SIL Allocation worksheets; 


e Recommendations (actions) lists. 
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4 WORKING DOCUMENTATION 


4.1 Basic documents 


Following is a list of documentation strictly necessary for the development of the SIL 
Allocation study. 


N Document Delivery time limits 
1 Process and Utilities Basis of Design One WEEK Belen SlLalibeation 
session 

2 Process Flow Diagram - PFD As above 

3 Utility Flow Diagram - UFD As above 

4 Project P&ID As above 

5 Booster Compressor P&ID As above 

6 Plot Plan As above 

7 Cause And Effect Diagram As above 

Control, Shutdown And Process Safeguarding 
8 Philosophy (ESD Philosophy) ke 
9 Blow down, Flaring and Venting Philosophy As above 


4.2 Supplementary documents 
The following documents shall be available in case of need: 
e MSDS (Material Safety Data Sheets) of dangerous substances; 
e Project Safety Philosophy document; 
e Emergency system design philosophy; 


e Detailed thematic plot plans, e.g. active fire systems, smoke/fire/gas detectors 
location, sewer networks, etc. 


e Operating, maintenance and emergency procedures /manuals, if available. 
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5 SIL ALLOCATION TEAM 
The SIL sessions, shall include following experts: 

e SIL facilitator (ICARO); 
e SIL Secretary (ENPPI or ICARO); 
e Lead HSE Engineer; 
e Lead Process Engineer; 
e Instrument Engineer (on call); 
e Process Engineer (Company); 
e Process/Operation specialist (Owner); 


e Mechanical / maintenance Engineer (on call). 
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6 SIL ALLOCATION PROGRAMME AND SCHEDULING 


6.1 Nodes identification 


Before starting SIL Allocation session, the selected SIFs will be inputted in the SIL 
Allocation. 


6.2 Logistics 


For successful development of HAZOP / SIL analysis sessions, the availability of a 
dedicated meeting room of suitable dimensions and windows, with large table and a 
video projection system for showing to all participants the worksheets in progress, is 
strongly required. 


It is also recommendable the availability of a suitable number of copies of C&EDs and 
P&IDs to be distributed to each participant (also in A3 format) plus one copy (in original 
size) to be used as Master Copy of the session. 


SIL Allocation meeting is normally scheduled with two distinct sessions (morning and 
afternoon) of maximum three hours each with suitable breaks. 


6.3 Scheduling 


According to preliminary documentation provided, the estimated duration of SIL 
Allocation session is 3 days. 
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ANNEX 1 — SIL ALLOCATION WORKSHEET 


poo medok | 1-0115 Design Intent Protection of V-01 against overfilling 
E ee 1 LAZHHO10 P&ID PID-0001-000 Final elements ESDV001 


Initiation Intermedi 


Vulnerabil SIF 
Impact event Impact TMEL likelihood | Time $ Additional| ate Event | . og 
E # | Cause A BPCS |Alarms ity pe integritiy 
description level |(occ./year) (occ./year| risk IPL mitigated 
(health) CMS level 
) likelihood 
Overfilling of V-01 . 
. 20 Failure 
leading to liquid carry 
1 a | openof 01 1 01 01 0,1 1 
and consequent 
n LV012 
overpressurization 
b 
C 
d 


HEALTH B 1,00E-06 
ENVIRONMENTAL C 1,00E-05 
ASSET C 1,00E-05 
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